﻿'         This file is Copyright © 2008-2012 Billy O'Neal and Aommaster
'                            All rights reserved.
'
' This file is released under the 2-Clause BSD license, included in LICENSE.TXT
'                           and on the MHWT website

Friend Class SyntaxGuide

    Private Sub ProgramBox_SelectedIndexChanged(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles ProgramBox.SelectedIndexChanged
        Dim selected As String = ProgramBox.SelectedItem.ToString()

        Select Case selected
            Case "Avenger"
                CommandBox.Items.Clear()
                SwitchBox.Items.Clear()
                CommandBox.Items.Add("Files to delete:")
                CommandBox.Items.Add("Files to replace with dummy:")
                CommandBox.Items.Add("Files to move:")
                CommandBox.Items.Add("Folders to delete:")
                CommandBox.Items.Add("Registry keys to delete:")
                CommandBox.Items.Add("Registry keys to replace with dummy:")
                CommandBox.Items.Add("Registry values to delete:")
                CommandBox.Items.Add("Registry values to replace with dummy:")
                CommandBox.Items.Add("Programs to launch on reboot:")
                CommandBox.Items.Add("Drivers to disable:")
                CommandBox.Items.Add("Drivers to delete:")
                CommandBox.Items.Add("Comment:")
                CommandBox.SelectedIndex = 0
                SwitchBox.SelectedIndex = -1
            Case "Combofix"
                CommandBox.Items.Clear()
                SwitchBox.Items.Clear()
                CommandBox.Items.Add("ADS::")
                CommandBox.Items.Add("AtJob::")
                CommandBox.Items.Add("AWF::")
                CommandBox.Items.Add("ClearJavaCache::")
                CommandBox.Items.Add("Collect::")
                CommandBox.Items.Add("DDS::")
                CommandBox.Items.Add("DeQuarantine::")
                CommandBox.Items.Add("DirLook::")
                CommandBox.Items.Add("Domains::")
                CommandBox.Items.Add("Driver::")
                CommandBox.Items.Add("Extra::")
                CommandBox.Items.Add("FCopy::")
                CommandBox.Items.Add("File::")
                CommandBox.Items.Add("FileLook::")
                CommandBox.Items.Add("Firefox::")
                CommandBox.Items.Add("Folder::")
                CommandBox.Items.Add("FMove::")
                CommandBox.Items.Add("KillAll::")
                CommandBox.Items.Add("MBR::")
                CommandBox.Items.Add("MIA::")
                CommandBox.Items.Add("NetSvc::")
                CommandBox.Items.Add("NetSvc64::")
                CommandBox.Items.Add("NoOrphans::")
                CommandBox.Items.Add("Quit::")
                CommandBox.Items.Add("Registry::")
                CommandBox.Items.Add("RegLock::")
                CommandBox.Items.Add("RegLockDel::")
                CommandBox.Items.Add("RegNull::")
                CommandBox.Items.Add("RenV::")
                CommandBox.Items.Add("Restore::")
                CommandBox.Items.Add("RestoreRun::")
                CommandBox.Items.Add("Rootkit::")
                CommandBox.Items.Add("SCopy::")
                CommandBox.Items.Add("SecCenter::")
                CommandBox.Items.Add("SkipFix::")
                CommandBox.Items.Add("SRPeek::")
                CommandBox.Items.Add("Suspect::")
                CommandBox.Items.Add("Snapshot::")
                CommandBox.Items.Add("SnapshotB::")
                CommandBox.Items.Add("SysRst::")
                CommandBox.Items.Add("TDL::")
                SwitchBox.Items.Add("/F3M")
                SwitchBox.Items.Add("/killall")
                SwitchBox.Items.Add("/NoOrphans")
                SwitchBox.Items.Add("/RestoreRun")
                SwitchBox.Items.Add("/SkipFix")
                SwitchBox.Items.Add("/Snapshot")
                SwitchBox.Items.Add("/SnapshotB")
                SwitchBox.Items.Add("/Uninstall")
                CommandBox.SelectedIndex = 0
                SwitchBox.SelectedIndex = 0
            Case "OTL"
                CommandBox.Items.Clear()
                SwitchBox.Items.Clear()
                CommandBox.Items.Add(":Processes")
                CommandBox.Items.Add(":OTL")
                CommandBox.Items.Add(":Services")
                CommandBox.Items.Add(":Reg")
                CommandBox.Items.Add(":Files")
                CommandBox.Items.Add(":Commands")
                CommandBox.Items.Add("   [PURITY]")
                CommandBox.Items.Add("   [EMPTYTEMP]")
                CommandBox.Items.Add("   [REBOOT]")
                CommandBox.Items.Add("   [RESETHOSTS]")
                CommandBox.Items.Add("   [EMPTYFLASH]")
                CommandBox.Items.Add("   [CREATERESTOREPOINT]")
                CommandBox.Items.Add("   [CLEARALLRESTOREPOINTS]")
                CommandBox.Items.Add("   [override]")
                CommandBox.Items.Add("   [stopoverride]")
                SwitchBox.Items.Add("/replace")
                SwitchBox.Items.Add("/C")
                SwitchBox.Items.Add("/FP")
                SwitchBox.Items.Add("/MD5")
                SwitchBox.Items.Add("    /MD5START")
                SwitchBox.Items.Add("    /MD5STOP")
                SwitchBox.Items.Add("    /LOCKEDFILES")
                SwitchBox.Items.Add("/RS")
                SwitchBox.Items.Add("/RP")
                SwitchBox.Items.Add("    /HL")
                SwitchBox.Items.Add("    /JN")
                SwitchBox.Items.Add("    /MP")
                SwitchBox.Items.Add("    /SL")
                SwitchBox.Items.Add("/SP")
                SwitchBox.Items.Add("/S")
                SwitchBox.Items.Add("/U")
                SwitchBox.Items.Add("/D")
                SwitchBox.Items.Add("/E")
                SwitchBox.Items.Add("/X")
                SwitchBox.Items.Add("/lsp")
                SwitchBox.Items.Add("/64")
                SwitchBox.Items.Add("/<Some Number>")
                CommandBox.SelectedIndex = 0
                SwitchBox.SelectedIndex = 0
            Case "OTM"
                CommandBox.Items.Clear()
                SwitchBox.Items.Clear()
                CommandBox.Items.Add(":Processes")
                CommandBox.Items.Add(":Services")
                CommandBox.Items.Add(":Reg")
                CommandBox.Items.Add(":Files")
                CommandBox.Items.Add(":Commands")
                CommandBox.Items.Add("   [Purity]")
                CommandBox.Items.Add("   [EmptyTemp]")
                CommandBox.Items.Add("   [StartExplorer]")
                CommandBox.Items.Add("   [Reboot]")
                SwitchBox.Items.Add("/<Some Number>")
                SwitchBox.Items.Add("/D")
                SwitchBox.Items.Add("/S")
                SwitchBox.Items.Add("/U")
                CommandBox.SelectedIndex = 0
                SwitchBox.SelectedIndex = 0
            Case "SystemLook"
                CommandBox.Items.Clear()
                SwitchBox.Items.Clear()
                CommandBox.Items.Add(":dir")
                CommandBox.Items.Add(":file")
                CommandBox.Items.Add(":reg")
                CommandBox.Items.Add(":service")
                CommandBox.Items.Add(":process")
                CommandBox.Items.Add(":filefind")
                CommandBox.Items.Add(":folderfind")
                CommandBox.Items.Add(":regfind")
                CommandBox.Items.Add(":env")
                CommandBox.Items.Add(":assoc")
                CommandBox.Items.Add(":contents")
                CommandBox.Items.Add(":comment")
                CommandBox.Items.Add("::csinfo")
                CommandBox.Items.Add("::safeboot")
                SwitchBox.Items.Add("/s or /sub")
                SwitchBox.Items.Add("/tX")
                SwitchBox.Items.Add("/nS")
                SwitchBox.Items.Add("/wS")
                SwitchBox.Items.Add("/nodirs")
                SwitchBox.Items.Add("/md5")
                SwitchBox.Items.Add("/noexpand")
                CommandBox.SelectedIndex = 0
                SwitchBox.SelectedIndex = 0
            Case Else
        End Select
    End Sub

    Private Sub CommandBox_SelectedIndexChanged(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles CommandBox.SelectedIndexChanged
        Dim selected As String = ProgramBox.SelectedItem.ToString()
        Dim selected1 As String = CommandBox.SelectedItem.ToString()

        Select Case selected
            Case "Avenger"
                switchdesc.Text = ""
                Select Case selected1
                    Case "Files to delete:"
                        commanddesc.Text = "Deletes a file"
                        example.Text = "Files to delete:" + Environment.NewLine + "C:\Windows\System32\badfile.dll"
                    Case "Files to replace with dummy:"
                        commanddesc.Text = "Replaces a file with a blank file"
                        example.Text = "Files to replace with dummy:" + Environment.NewLine + "C:\Windows\System32\badfile.dll"
                    Case "Files to move:"
                        commanddesc.Text = "Moves a file"
                        example.Text = "Files to move:" + Environment.NewLine + "C:\Windows\System32\badfile.dll | C:\renamed.dll"
                    Case "Folders to delete:"
                        commanddesc.Text = "Deletes a folder"
                        example.Text = "Folders to delete:" + Environment.NewLine + "C:\Bad Folder"
                    Case "Registry keys to delete:"
                        commanddesc.Text = "Deletes a registry key"
                        example.Text = "Registry keys to delete:" + Environment.NewLine + "HKLM\Software\BadKey"
                    Case "Registry keys to replace with dummy:"
                        commanddesc.Text = "Replaces registry keys with null values"
                        example.Text = "Registry keys to replace with dummy:" + Environment.NewLine + "HKLM\Software\BadKey"
                    Case "Registry values to delete:"
                        commanddesc.Text = "Deletes a single registry value"
                        example.Text = "Registry values to delete:" + Environment.NewLine + "HKLM\Software\SomeKey | BadValue"
                    Case "Registry values to replace with dummy:"
                        commanddesc.Text = "Replaces a single registry value with a null value"
                        example.Text = "Registry values to replace with dummy:" + Environment.NewLine + "HKLM\Software\SomeKey | BadValue"
                    Case "Programs to launch on reboot:"
                        commanddesc.Text = "Runs a program on reboot"
                        example.Text = "Programs to launch on reboot:" + Environment.NewLine + "%systemdrive%\my_fix.bat"
                    Case "Drivers to disable:"
                        commanddesc.Text = "Unloads and disables a driver"
                        example.Text = "Drivers to disable:" + Environment.NewLine + "baddriver"
                    Case "Drivers to delete:"
                        commanddesc.Text = "Unloads and deletes a driver"
                        example.Text = "Drivers to delete:" + Environment.NewLine + "baddriver"
                    Case "Comment:"
                        commanddesc.Text = "Inserts a comment"
                        example.Text = "Comment:" + Environment.NewLine + "This script will delete bad files"
                    Case Else
                End Select
            Case "Combofix"
                switchdesc.Text = ""
                Select Case selected1
                    Case "ADS::"
                        commanddesc.Text = "Removes alternate data stream"
                        example.Text = "ADS::" + Environment.NewLine + "C:\WINDOWS\ieuninst.exe:agsta"
                    Case "AtJob::"
                        commanddesc.Text = "Removes AT*.job files"
                        example.Text = "AtJob::"
                    Case "AWF::"
                        commanddesc.Text = "Deletes AWF imposter and replaces with original"
                        example.Text = "AWF::" + Environment.NewLine + "C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe"
                    Case "ClearJavaCache::"
                        commanddesc.Text = "Clears Sun Java Cache"
                        example.Text = "ClearJavaCache::"
                    Case "Collect::"
                        commanddesc.Text = "Uploads a sample and deletes the file"
                        example.Text = "http://www.<link to thread that contains file>" + Environment.NewLine + "Collect::[4]" + Environment.NewLine + "C:\jzzisqsr.sys"
                    Case "DDS::"
                        commanddesc.Text = "Processes DDS pseudo-HJT entries"
                        example.Text = "DDS::" + Environment.NewLine + "uRun: [rs32net] c:\windows\system32\rs32net.exe"
                    Case "DeQuarantine::"
                        commanddesc.Text = "Removes a file from quarantine"
                        example.Text = "DeQuarantine::" + Environment.NewLine + "C:\Qoobox\Quarantine\C\Windows\wpa.dbl.vir"
                    Case "DirLook::"
                        commanddesc.Text = "Displays contents of a directory"
                        example.Text = "DirLook::" + Environment.NewLine + "C:\DOCUME~1\Mel\max"
                    Case "Domains::"
                        commanddesc.Text = "Resets Domains, Ranges,EscDomains to default"
                        example.Text = "Domains::"
                    Case "Driver::"
                        commanddesc.Text = "Removes a driver from the registry"
                        example.Text = "Driver::" + Environment.NewLine + "lgmojfno"
                    Case "Extra::"
                        commanddesc.Text = "Produced a supplementary scan"
                        example.Text = "Extra::"
                    Case "FCopy::"
                        commanddesc.Text = "Copies a file from one location to another"
                        example.Text = "FCopy::" + Environment.NewLine + "c:\windows\initialfile.dll | c:\finalfile.dll"
                    Case "File::"
                        commanddesc.Text = "Deletes a file"
                        example.Text = "File::" + Environment.NewLine + "c:\windows\system32\badfile.dll"
                    Case "FileLook::"
                        commanddesc.Text = "Extracts file properties for a file"
                        example.Text = "FileLook::" + Environment.NewLine + "C:\jzzisqsr.sys"
                    Case "Firefox::"
                        commanddesc.Text = "Deletes firefox-related registry entries"
                        example.Text = "Firefox::" + Environment.NewLine + "FireFox -: Profile - C:\Mozilla\Firefox\Profiles\test\" + Environment.NewLine + "FireFox -: user.js - STARTUP.HOMEPAGE - hxxp://mail.google.com/mail/"
                    Case "Folder::"
                        commanddesc.Text = "Deletes a folder"
                        example.Text = "Folder::" + Environment.NewLine + "c:\windows\bad folder"
                    Case "FMove::"
                        commanddesc.Text = "Moves a file from one location to another"
                        example.Text = "FMove::" + Environment.NewLine + "c:\windows\initialfile.dll | c:\finalfile.dll"
                    Case "KillAll::"
                        commanddesc.Text = "Terminates all non-essential running processes"
                        example.Text = "KillAll::"
                    Case "MBR::"
                        commanddesc.Text = "Fixes the MBR"
                        example.Text = "MBR::"
                    Case "MIA::"
                        commanddesc.Text = "Finds replacements for a file"
                        example.Text = "MIA::" + Environment.NewLine + "c:\windows\system32\taskman.exe"
                    Case "NetSvc::"
                        commanddesc.Text = "Deletes entries from the NetSvcs registry key"
                        example.Text = "Netsvc::" + Environment.NewLine + "sb33043832"
                    Case "NoOrphans::"
                        commanddesc.Text = "Prevents combofix from auto-fixing orphaned entries"
                        example.Text = "NoOrphans::"
                    Case "Quit::"
                        commanddesc.Text = "Terminates Combofix once script is executed"
                        example.Text = "Quit::"
                    Case "Registry::"
                        commanddesc.Text = "Executes a registry script"
                        example.Text = "Registry::" + Environment.NewLine + "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]" + Environment.NewLine + """{F9765480-72D1-11D4-A75A-004F49045A87}""=-"
                    Case "RegLock::"
                        commanddesc.Text = "Unlocks a reigstry key"
                        example.Text = "RegLock::" + Environment.NewLine + "[HKEY_LOCAL_MACHINE\software\Microsoft\MS Juan\DJZERO]"
                    Case "RegLockDel::"
                        commanddesc.Text = "Unlocks and deletes a registry key"
                        example.Text = "RegLockDel::" + Environment.NewLine + "[HKEY_LOCAL_MACHINE\software\Microsoft\MS Juan\DJZERO]"
                    Case "RegNull::"
                        commanddesc.Text = "Deletes null-embedded keys"
                        example.Text = "RegNull::" + Environment.NewLine + "[HKEY_LOCAL_MACHINE\SOFTWARE\swearware\test*]"
                    Case "RenV::"
                        commanddesc.Text = "Restores Vundo-infected files"
                        example.Text = "RenV::" + Environment.NewLine + "----a-w           159,744 2008-01-02 03:48:58  C:\WINDOWS\system32\hkcmd .exe"
                    Case "Restore::"
                        commanddesc.Text = "Restores a file from Windows Vista restore cache"
                        example.Text = "Restore::" + Environment.NewLine + "C:\Windows\explorer.exe"
                    Case "RestoreRun::"
                        commanddesc.Text = "Restores the HKLM\~\Run and the HKCU\~\Run registry branches"
                        example.Text = "RestoreRun::"
                    Case "Rootkit::"
                        commanddesc.Text = "Deletes a rootkit-hidden file"
                        example.Text = "Rootkit::" + Environment.NewLine + "c:\windows\system32\badfile.dll"
                    Case "SCopy::"
                        commanddesc.Text = "Copies a file from system restore"
                        example.Text = "SCopy::" + Environment.NewLine + "\RP229\A0104086.scr|c:\documents and settings\sUBs\Desktop\dds.scr"
                    Case "SecCenter::"
                        commanddesc.Text = "Removes WMI reference to AV/FW products that are no longer installed"
                        example.Text = "SecCenter::" + Environment.NewLine + "{645C2AD3-E094-4496-9AB2-015867D4734F}"
                    Case "SkipFix::"
                        commanddesc.Text = "Runs Combofix in reduced functionality mode"
                        example.Text = "SkipFix::"
                    Case "SRPeek::"
                        commanddesc.Text = "Searches through system restore for a file match"
                        example.Text = "SRPeek::" + Environment.NewLine + "C:\Windows\System32\userinit.exe"
                    Case "Suspect::"
                        commanddesc.Text = "Uploads a sample"
                        example.Text = "http://www.<link to thread that contains file>" + Environment.NewLine + "Suspect::[4]" + Environment.NewLine + "C:\jzzisqsr.sys"
                    Case "Snapshot::"
                        commanddesc.Text = "Produces a snapshot report"
                        example.Text = "Snapshot::"
                    Case "SnapshotB::"
                        commanddesc.Text = "Produces a snapshot report and updates the snapshot"
                        example.Text = "SnapshotB::"
                    Case "SysRst::"
                        commanddesc.Text = "Produces a system restore report"
                        example.Text = "SysRst::"
                    Case "TDL::"
                        commanddesc.Text = "Fixes a variant of the TDSS infection"
                        example.Text = "TDL::" + Environment.NewLine + "C:\WINDOWS\system32\drivers\intelide.sys"
                End Select
            Case "OTL"
                switchdesc.Text = ""
                Select Case selected1
                    Case ":Processes"
                        commanddesc.Text = "Terminates a process"
                        example.Text = ":Processes" + Environment.NewLine + "Explorer.exe"
                    Case ":OTL"
                        commanddesc.Text = "Processes an OTL line"
                        example.Text = ":OTL" + Environment.NewLine + "O30 - LSA: Authentication Packages - (badfile.dll) - C:\badfile.dll ()"
                    Case ":Services"
                        commanddesc.Text = "Deletes a service"
                        example.Text = ":Services" + Environment.NewLine + "badservice"
                    Case ":Reg"
                        commanddesc.Text = "Runs a reg script"
                        example.Text = ":Reg" + Environment.NewLine + "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]" + Environment.NewLine + """{F9765480-72D1-11D4-A75A-004F49045A87}""=-"
                    Case ":Files"
                        commanddesc.Text = "Deletes a file or folder"
                        example.Text = ":Files" + Environment.NewLine + "C:\Windows\badfile.dll"
                    Case ":Commands"
                        commanddesc.Text = ""
                        example.Text = ""
                    Case "   [PURITY]"
                        commanddesc.Text = "Searches and deletes any purity folders"
                        example.Text = ":Commands" + Environment.NewLine + "[PURITY]"
                    Case "   [EMPTYTEMP]"
                        commanddesc.Text = "Empties temp folders"
                        example.Text = ":Commands" + Environment.NewLine + "[EMPTYTEMP]"
                    Case "   [REBOOT]"
                        commanddesc.Text = "Reboots after script execution"
                        example.Text = ":Commands" + Environment.NewLine + "[REBOOT]"
                    Case "   [RESETHOSTS]"
                        commanddesc.Text = "Resets the hosts file"
                        example.Text = ":Commands" + Environment.NewLine + "[RESETHOSTS]"
                    Case "   [CREATERESTOREPOINT]"
                        commanddesc.Text = "Creates a new restore point"
                        example.Text = ":Commands" + Environment.NewLine + "[CREATERESTOREPOINT]"
                    Case "   [CLEARALLRESTOREPOINTS]"
                        commanddesc.Text = "Removes all restore points"
                        example.Text = ":Commands" + Environment.NewLine + "[CLEARALLRESTOREPOINTS]"
                    Case "   [override]"
                        commanddesc.Text = "Override internal list of non-movable files"
                        example.Text = ":Files" + Environment.NewLine + "[override]" + Environment.NewLine + "c:\windows\system32\userinit.exe" + Environment.NewLine + "[stopoverride]"
                    Case "   [stopoverride]"
                        commanddesc.Text = "Override internal list of non-movable files"
                        example.Text = ":Files" + Environment.NewLine + "[override]" + Environment.NewLine + "c:\windows\system32\userinit.exe" + Environment.NewLine + "[stopoverride]"
                End Select
            Case "OTM"
                switchdesc.Text = ""
                Select Case selected1
                    Case ":Processes"
                        commanddesc.Text = "Terminates a process"
                        example.Text = ":Processes" + Environment.NewLine + "Explorer.exe"
                    Case ":Services"
                        commanddesc.Text = "Deletes a service"
                        example.Text = ":Services" + Environment.NewLine + "badservice"
                    Case ":Reg"
                        commanddesc.Text = "Runs a reg script"
                        example.Text = ":Reg" + Environment.NewLine + "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]" + Environment.NewLine + """{F9765480-72D1-11D4-A75A-004F49045A87}""=-"
                    Case ":Files"
                        commanddesc.Text = "Deletes a file or folder"
                        example.Text = ":Files" + Environment.NewLine + "C:\Windows\badfile.dll"
                    Case ":Commands"
                        commanddesc.Text = ""
                        example.Text = ""
                    Case "   [Purity]"
                        commanddesc.Text = "Searches and deletes any purity folders"
                        example.Text = ":Commands" + Environment.NewLine + "[Purity]"
                    Case "   [EmptyTemp]"
                        commanddesc.Text = "Empties temp folders"
                        example.Text = ":Commands" + Environment.NewLine + "[EmptyTemp]"
                    Case "   [StartExplorer]"
                        commanddesc.Text = "Restarts explorer.exe"
                        example.Text = ":Commands" + Environment.NewLine + "[StartExplorer]"
                    Case "   [Reboot]"
                        commanddesc.Text = "Reboots after script execution"
                        example.Text = ":Commands" + Environment.NewLine + "[Reboot]"
                End Select
            Case "SystemLook"
                switchdesc.Text = ""
                Select Case selected1
                    Case ":dir"
                        commanddesc.Text = "Provides a directory listing"
                        example.Text = ":dir" + Environment.NewLine + "C:\Windows\unknownfolder"
                    Case ":file"
                        commanddesc.Text = "Provides file information"
                        example.Text = ":file" + Environment.NewLine + "%systemroot%\notepad.exe"
                    Case ":reg"
                        commanddesc.Text = "List values and subkeys of a registry key"
                        example.Text = ":reg" + Environment.NewLine + "HKLM\Software\Microsoft\Windows\CurrentVersion\Run"
                    Case ":service"
                        commanddesc.Text = "Gets service information"
                        example.Text = ":service" + Environment.NewLine + "MalwareDriver"
                    Case ":process"
                        commanddesc.Text = "Displays full path to process"
                        example.Text = ":process" + Environment.NewLine + "svchost.exe"
                    Case ":filefind"
                        commanddesc.Text = "Searches for a file based on name"
                        example.Text = ":filefind" + Environment.NewLine + "atapi.sy*"
                    Case ":folderfind"
                        commanddesc.Text = "Searches for a folder based on name"
                        example.Text = ":folderfind" + Environment.NewLine + "*windows*"
                    Case ":regfind"
                        commanddesc.Text = "Searches the registry for a key, value or value data based on name"
                        example.Text = ":regfind" + Environment.NewLine + "AntiVirus2009"
                    Case ":env"
                        commanddesc.Text = "Expands any environment variable"
                        example.Text = ":env" + Environment.NewLine + "%TEMP%"
                    Case ":assoc"
                        commanddesc.Text = "Displays file association of an extension"
                        example.Text = ":assoc" + Environment.NewLine + ".txt"
                    Case ":contents"
                        commanddesc.Text = "Dumps file contents into a file"
                        example.Text = ":contents" + Environment.NewLine + "C:\unknownreg.bat"
                    Case ":comment"
                        commanddesc.Text = "Inserts a comment"
                        example.Text = ":comment" + Environment.NewLine + "This is a comment"
                    Case "::csinfo"
                        commanddesc.Text = "Provides basic information on control sets available"
                        example.Text = "::csinfo"
                    Case "::safeboot"
                        commanddesc.Text = "Provides information under the CCS\Control\SafeBoot key"
                        example.Text = "::safeboot"
                End Select


        End Select
    End Sub

    Private Sub syntaxbox_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
        ProgramBox.SelectedIndex = 0
        CommandBox.SelectedIndex = 0
        SwitchBox.SelectedIndex = -1
    End Sub

    Private Sub SwitchBox_SelectedIndexChanged(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles SwitchBox.SelectedIndexChanged
        Dim selected As String = ProgramBox.SelectedItem.ToString()

        Dim selected2 As String = ""
        If SwitchBox.SelectedIndex <> -1 Then
            selected2 = SwitchBox.SelectedItem.ToString()
            Select Case selected
                Case "Avenger"
                Case "Combofix"
                    Select Case selected2
                        Case "/F3M"
                            switchdesc.Text = "Generates F3M report only"
                        Case "/killall"
                            switchdesc.Text = "Terminates all non-essential processes before running"
                        Case "/NoOrphans"
                            switchdesc.Text = "Disables orphan auto-fixing"
                        Case "/RestoreRun"
                            switchdesc.Text = "Repairs boot registry keys"
                        Case "/SkipFix"
                            switchdesc.Text = "Runs Combofix in reduced functionality mode"
                        Case "/Snapshot"
                            switchdesc.Text = "Generates a snapshot report"
                        Case "/SnapshotB"
                            switchdesc.Text = "Updates the snapshot"
                        Case "/Uninstall"
                            switchdesc.Text = "Uninstalls Combofix"
                    End Select
                Case "OTL"
                    Select Case selected2
                        Case "/replace"
                            switchdesc.Text = "Replaces a file with another"
                        Case "/C"
                            switchdesc.Text = "Runs a DOS command line"
                        Case "/FP"
                            switchdesc.Text = "Runs a file/folder name pattern search"
                        Case "/MD5"
                            switchdesc.Text = "Include MD5 values for all files"
                        Case "    /MD5START"
                            switchdesc.Text = "Use with /MD5STOP to wrap around files"
                        Case "    /MD5STOP"
                            switchdesc.Text = "Use with /MD5START to wrap around files"
                        Case "    /LOCKEDFILES"
                            switchdesc.Text = "Find the locked file for which an MD5 cannot be obtained"
                        Case "/RS"
                            switchdesc.Text = "Performs a registry search for a pattern"
                        Case "/RP"
                            switchdesc.Text = "Search for all types reparse points"
                        Case "    /HL"
                            switchdesc.Text = "Search for only hard links"
                        Case "    /JN"
                            switchdesc.Text = "Search for only junctions"
                        Case "    /MP"
                            switchdesc.Text = "Search for only mount points"
                        Case "    /SL"
                            switchdesc.Text = "Search for only symbolic links"
                        Case "/SP"
                            switchdesc.Text = "Perform string pattern search within files"
                        Case "/S"
                            switchdesc.Text = "Recurse through subfolders"
                        Case "/U"
                            switchdesc.Text = "Only include unicode files in search"
                        Case "/D"
                            switchdesc.Text = "Delete a file instead of moving it"
                        Case "/E"
                            switchdesc.Text = "Extract from cab file"
                        Case "/X"
                            switchdesc.Text = "Exclude file from search"
                        Case "/lsp"
                            switchdesc.Text = "Deletes file from LSP stack"
                        Case "/64"
                            switchdesc.Text = "Acess 64-bit folder location"
                        Case "/<Some Number>"
                            switchdesc.Text = "Apply to files created within <Some Number> days"
                    End Select
                Case "OTM"
                    Select Case selected2
                        Case "/<Some Number>"
                            switchdesc.Text = "Apply to files created within <Some Number> days"
                        Case "/D"
                            switchdesc.Text = "Delete a file instead of moving it"
                        Case "/S"
                            switchdesc.Text = "Recurse through subfolders"
                        Case "/U"
                            switchdesc.Text = "Only include unicode files in search"
                    End Select
                Case "SystemLook"
                    Select Case selected2
                        Case "/s or /sub"
                            switchdesc.Text = "Enumerate through subfolders"
                        Case "/tX"
                            switchdesc.Text = "Time filter"
                        Case "/nS"
                            switchdesc.Text = "Name filter"
                        Case "/wS"
                            switchdesc.Text = "Used if full folder names are not known"
                        Case "/nodirs"
                            switchdesc.Text = "Prevents subfolders from being listed"
                        Case "/md5"
                            switchdesc.Text = "Produces an MD5 checksum for each file found"
                        Case "/noexpand"
                            switchdesc.Text = "Supresses expansion of environment variables"
                    End Select

                Case Else
            End Select
        End If
    End Sub
End Class